Loading malware…
Ragnar Locker is a human-operated Windows ransomware family and associated extortion operation first observed in late 2019 and active through at least 2021 against enterprise environments, including critical infrastructure sectors such as manufacturing, energy, financial services, government, information technology, telecommunications, and healthcare-related organizations. The operation is known for double extortion: operators steal sensitive data prior to encryption and threaten public release of the stolen material through leak infrastructure if victims refuse to pay. Public reporting has also associated the group with additional pressure tactics such as DDoS attacks against victims.
Ragnar Locker infections are typically highly targeted and customized per victim. Reported intrusion patterns include compromise of exposed remote access services using stolen or weak credentials, reconnaissance inside the victim network, privilege escalation, and lateral movement before ransomware deployment. The malware has also been observed delivered as an MSI package executed through msiexec, and operators have been linked to abuse of signed Windows binaries such as regsvr32 and rundll32 to execute components related to their tooling.
A distinctive defense-evasion technique used by Ragnar Locker is execution from within a specially prepared VirtualBox virtual machine, including use of a Windows XP guest image with host drives mapped into the guest so encryption activity appears to originate from trusted virtualization processes rather than directly from the host. Samples have also used packing and anti-analysis measures including VMProtect, debugger detection, and API hooking to terminate when analysis is attempted.
On execution, Ragnar Locker performs locale checks and terminates on systems configured for multiple CIS and former Soviet language settings. It enumerates drives and volumes, may force-map additional volumes, stops selected services and processes to unlock files, and targets backup, database, security, remote monitoring, and managed service provider tooling, including products commonly used for remote administration and backup operations. It deletes shadow copies and disables Windows recovery features to hinder restoration. Encryption has been reported to use Salsa20 for file data protection with RSA-2048 public-key cryptography protecting generated encryption material. Encrypted files receive victim-specific extensions and ransom notes are dropped across affected systems and displayed to users.
Ragnar Locker has been linked to the threat cluster also referred to as Monstrous Mantis, and related tooling such as Ragnar Loader, also known as Sardonic, has been described as supporting persistent access and broader network takeover. Reporting has also noted some form of affiliation with Mount Locker, though the exact relationship has remained unclear. The operation participated in the broader ransomware ecosystem’s trend toward leak-site collaboration and data-publication extortion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges. | Analysis of Ragnar Locker Ransomware. First discovered in April 2020. Uses the increasingly popular “double extortion” tactic, in which the attacker first exfiltrates sensitive data, then triggers the encryption attack, threatening to leak the stolen data if the target refuses to pay the ransom.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The organization in question came to Sophos Rapid Response after falling victim to a Ragnar Locker attack in early 2020.
In a recently detected attack, Ragnar Locker ransomware was deployed inside an Oracle VirtualBox Windows XP virtual machine.
The Russian-speaking cybercriminal group has a dark web site under a different name, dubbed "Dunghill Leak," and doesn't have its own ransomware; Dark Angels has used variants of other ransomware such as Ragnar Locker.
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Ragnar Locker can be run with ‘-list’ or ‘-force’ command-line options.
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
ntdll.dllのDbgUiRemoteBreakinの先頭5バイトを自身のオリジナルのフック関数へジャンプするようにメモリを書き換えます。
To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges.
暗号化ファイルの拡張子変更は、以下のようにMoveFileExを使用し、ファイル移動させることでリネームします。
ntdll.dllのDbgUiRemoteBreakinの先頭5バイトを自身のオリジナルのフック関数へジャンプするようにメモリを書き換えます。
The threat actor begin the attack by compromising the company’s network via RDP service, using brute force to guess weak passwords or with stolen credentials bought on the Dark Web.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
In all cases, the original entry point is to start network reconnaissance, then lateral movement, then data exfiltration.
ローカルドライブとしてマッピングされていないボリュームを発見した場合、強制的にローカルドライブとしてマッピングした上で、暗号化を行います。
Ragnar Lockerは、実行された環境がロシア語など特定の言語情報が設定された端末であった場合、感染を行いません。具体的には、GetLocaleInfoにより感染端末の言語設定情報を取得し、特定の国リストと比較した結果、同じであった場合、最終的に自身のプロセスを強制終了させます。
Before encrypting a victim's network, most network-targeting ransomware operations will steal a victim's unencrypted files.
the ransomware would enumerate all of the running Windows services on the victim's computer and if any of the services contain certain strings, the ransomware would stop the service.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that encrypts files and uses a defense-evasion technique by running from inside a VirtualBox-hosted Windows XP virtual machine. The operators also steal data before encryption to pressure victims into paying and use administrative tools, GPOs, and MSI deployment for lateral movement and execution.
Ransomware that deploys a full virtual machine on targeted devices to evade security tools.
Ransomware noted for deploying a VirtualBox VM to hide malicious processes from scanners and avoid AMSI-related visibility.
Ransomware used in a prior attack against the victim organization, manually deployed across hundreds of computers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.